Overview
overview
10Static
static
10BIBLE 2023...AL.pdf
windows10-2004-x64
1BIBLE 2023...D).pdf
windows10-2004-x64
1BIBLE 2023...te.pdf
windows10-2004-x64
1BIBLE 2023...er.pdf
windows10-2004-x64
1BIBLE 2023...an.pdf
windows10-2004-x64
1BIBLE 2023...Cs.pdf
windows10-2004-x64
1BIBLE 2023...DE.pdf
windows10-2004-x64
1BIBLE 2023...AL.pdf
windows10-2004-x64
1BIBLE 2023...LS.pdf
windows10-2004-x64
1BIBLE 2023...ER.pdf
windows10-2004-x64
1BIBLE 2023...1).pdf
windows10-2004-x64
1BIBLE 2023...UT.pdf
windows10-2004-x64
1BIBLE 2023...m .pdf
windows10-2004-x64
1BIBLE 2023...pe.pdf
windows10-2004-x64
1BIBLE 2023...4l.pdf
windows10-2004-x64
1BIBLE 2023...s .pdf
windows10-2004-x64
1BIBLE 2023...23.pdf
windows10-2004-x64
1BIBLE 2023...rd.pdf
windows10-2004-x64
1BIBLE 2023...es.pdf
windows10-2004-x64
1BIBLE 2023...1).pdf
windows10-2004-x64
1BIBLE 2023...de.pdf
windows10-2004-x64
1BIBLE 2023...it.pdf
windows10-2004-x64
1BIBLE 2023...ER.pdf
windows10-2004-x64
1BIBLE 2023...ut.pdf
windows10-2004-x64
1BIBLE 2023...ps.pdf
windows10-2004-x64
1BIBLE 2023...ns.pdf
windows10-2004-x64
1BIBLE 2023...in.pdf
windows10-2004-x64
1BIBLE 2023...2).pdf
windows10-2004-x64
1BIBLE 2023...21.pdf
windows10-2004-x64
1BIBLE 2023...OG.pdf
windows10-2004-x64
1BIBLE 2023...on.pdf
windows10-2004-x64
1BIBLE 2023...LS.pdf
windows10-2004-x64
1Analysis
-
max time kernel
127s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 23:16
Behavioral task
behavioral1
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/ACCOUNT TAKEOVER TUTORIAL.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/ACH TRANSFER TUTORIAL(BANK LOAD).pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/ACH transfer Update.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral4
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/ACH_Transfer.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/Applebank Loan.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/Art of Cashing Out VCCs.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/BANK DROP GUIDE.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral8
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/BANKERS MANUAL.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/BLUEVINE TUTORIALS.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral10
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/BMG MONEY LOAN- LUCIFER.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/CC Authorization (1).pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/CHASE CREDIT ONLY CASHOUT.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/CW Mini Bank Open Up Guide @CeeDubzz on Telegram .pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/Cash out dirty funds with Stripe.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/Chase cc tut by @despite4l.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral16
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/Checks and deposits .pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/Cheque bundle 2023.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/Citi tut by @hack4nfrd.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/Citizens_Bank_Open_up_wth_images.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/FUNDS (1).pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/Fullz_Loan_Cashout_Guide.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral22
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/GECU_OPEN_UP_TUTORIAL_limited_edit.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/HANMI BANK LOAN - LUCIFER.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/How to Open a Verified Stripe Account in For Cashout.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/How to open your OWN Bank Drops.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral26
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/How_to_Apply_for_USA_Loans.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/How_to_Open_a_Non-Resident_Bank_Account_in_Spain.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/INGO LOADING METHOD (2).pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/LATEST SBA METHOD STEP BY STEP - March 2021.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral30
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/LOADING CASHAPP USING AN HUNTINGTON BANK LOG.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/Navy Federal Credit Union.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/PAYPAL LOADING USING BANK LOG TUTORIALS.pdf
Resource
win10v2004-20240508-en
General
-
Target
BIBLE 2023/ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS/Citizens_Bank_Open_up_wth_images.pdf
-
Size
998KB
-
MD5
b9ae20bc61a3146ecf9d9910618a370e
-
SHA1
51dd4de3d7fc0ef500501cc2355f93ec835a5daa
-
SHA256
ca828a6806bdd43e70986970e84e01ac900bbe45987d827383847885a20a9f17
-
SHA512
da32d0d4bc2309054a71ccacce9796e520477e50108d94d406393aef8db2f16a37e0e249a6af5aa20cbc86b319ffed4242e7a66ace642da1049214e4bb6ecb5a
-
SSDEEP
24576:P6Knj5XZNAm5fDbqC/29kUSONPUwamgBcrc668rvvINl9:SmVJzDOC/29kUSlwTccgqA79
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3928 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3928 AcroRd32.exe 3928 AcroRd32.exe 3928 AcroRd32.exe 3928 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3928 wrote to memory of 4260 3928 AcroRd32.exe 85 PID 3928 wrote to memory of 4260 3928 AcroRd32.exe 85 PID 3928 wrote to memory of 4260 3928 AcroRd32.exe 85 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5044 4260 RdrCEF.exe 86 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87 PID 4260 wrote to memory of 5088 4260 RdrCEF.exe 87
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BIBLE 2023\ACH, BANK LOADING, OPEN UPS, ENROLLS, CHECKS, LOANS\Citizens_Bank_Open_up_wth_images.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9F932F092DD276906CEC807E866CF23E --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:5044
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8DAA4B6C32EE41D2B2481A15309F7D5C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8DAA4B6C32EE41D2B2481A15309F7D5C --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵PID:5088
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6851F7CD397A168052B4B93BA6A1F77E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6851F7CD397A168052B4B93BA6A1F77E --renderer-client-id=4 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job /prefetch:13⤵PID:4016
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2341E56CC1805ECD6C9FBB4596DFD723 --mojo-platform-channel-handle=2696 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:5032
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D91EC0F6026CF5ED04C95125BC952DD7 --mojo-platform-channel-handle=2672 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4680
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DF7D588B5A93F8057255C86EF63F0C88 --mojo-platform-channel-handle=2928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:528
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5566a689465095a62bc8cd6f72e0e7f27
SHA1158707fa3e8f3ce220d1c61dadb5db3164e76220
SHA25699216495bd481e9026d763b3d2cac06263c531b2599345c3191faa2aa4eb4ef9
SHA512ff1e217036a448eaa9b005d13ea1a359644c5304280535b02242c9fd157c6e3f876282a84bcba31b4a0c6ebc14b42665099f971791d286b91564931cdf5f472f
-
Filesize
64KB
MD5ade21237823aa7a7cd4eba52481e317a
SHA13fa8be9af8b489fc096270257f1dd0efcaaedc4f
SHA2560609a55ad4706f1053439f280df4730074f0ac7512fd51c226728eceb23fd2b0
SHA512c82b1cb31d6421dce8aef75896ed942ac16834a2c7766b7aa62d42c4efa01d9f9292fec2be59163276956bcf2a661d8754a540f803816ec4179263b69d7e158e